Presenting it as an empirical finding — "studies show that operators cannot monitor" — overstates the field's evidence base. This paper cites it as what it is: a theoretical statement of a problem, whose empirical content must be supplied from elsewhere. The quotations below were verified against a full-text mirror rather than the publisher's own file, and should be rechecked against the Automatica PDF before they are set in print. The irony most often quoted from the paper is the monitoring claim: that "it is impossible for even a highly motivated human being to maintain effective visual attention towards a source of information on which very little happens, for more than about half an hour." Two corrections are needed. The "about half an hour" is Bainbridge's summary of the then-existing vigilance literature in the Mackworth tradition, not a finding of her own, and attributing it to her as a result is a citation error. The best-sourced modern figure, and the one Section 4 uses, is from a peer-reviewed review by the field's leading authorities: detection accuracy in vigilance tasks declines by about 10 to 15 per cent after about 30 minutes, with most of that decline occurring within the first 15 (Warm, Parasuraman, & Matthews, 2008). The irony that actually transfers to AI-era management is a different one, and it is quoted far less often. Bainbridge observes that "if the decisions can be fully specified then a computer can make them more quickly, taking into account more dimensions and using more accurately specified criteria than a human operator can. There is therefore no way in which the human operator can check in real-time that the computer is following its rules correctly." The corollary she draws is the sentence a firm deploying agents should read twice: if the human is nonetheless required to follow the details, then "it is necessary for the computer to make these decisions using methods and criteria, and at a rate, which the operator can follow." That is not a complaint about human frailty. It is a statement that contemporaneous verification imposes a design constraint on the machine — on its method, its criteria and above all its rate — and that a system optimised for throughput has already spent the budget that verification would have required. Definition 1 is a formalisation of that observation, and Proposition 12's scaling dichotomy is its consequence. The field itself is not settled, and a paper that presents it as settled is not citation-grade. Endsley (2017), in a peer-reviewed review, names the "automation conundrum" — that as autonomy is added and reliability and robustness increase, operators' situation awareness falls and their ability to take over manual control declines — but treats it explicitly as a design problem, and devotes the article to interface features, levels of automation, adaptive automation and granularity of control as remedies. The most prominent critic of full autonomy in the field does not regard the difficulty as an inevitability. The strongest quantitative summary available is a peer-reviewed meta-analysis of 18 experiments (Onnasch, Wickens, Li, & Manzey, 2014), which finds clear benefits of a higher degree of automation for routine performance, weaker but present workload reduction in normal operation, and negative effects on failure performance and on situation awareness, with a critical performance boundary between automation that supports information analysis and automation that supports action selection: crossing from the former to the latter is where the costs appear. That boundary matters directly for the argument of Section 8, since the reconstructed model proposed there is in substance a proposal to place human effort on the analysis side of it. The meta-analysis reports its results by Human-on-the-Loop · WP No. 8 2. What Human-on-the-Loop Is: Provenance and Definition 12 significance rather than in standardised units, and no effect sizes are extractable from the accessible text; none is quoted here, and no reader should accept one quoted elsewhere without checking the source. Finally, the framework that supplies this paper's technical anchor is contested from within its own field. Wickens (2018), in a twenty-year retrospective on the stages-and-levels model he co-authored, responds to Kaber's concerns about the model's utility in design with "both simplifications and elaborations," and Jamieson and Skraaning (2018) argue that the levels-of-automation approach may not generalise to complex real work settings. The dispute is live and this paper does not resolve it. The position taken here is therefore narrower than the pessimistic reading and does not depend on it. Nothing in the argument requires that humans cannot monitor, that automation inevitably degrades its supervisors, or that Bainbridge's essay was empirically right. What the argument requires is quantities: response latencies against consequence latencies, exception arrival rates against uncommitted attention, detection rates against prevalence, and error correlation between a generator and its verifier. Those quantities are measurable, several of them have been measured, and where they have not been measured in the setting that matters, this paper says so and proposes how a firm might measure them itself. 3. Position Is Determined, Not Chosen 3.1 The argument in one move The proposition this section defends is simple to state and consequential enough to reorganise the rest of the paper. A firm does not choose its loop position. The ratio of the system's consequence latency to the human's response latency chooses it, and the firm's governance policy is at most a statement of intent about a variable it does not control. Definition 1, boxed in Section 2, fixes the terms. For a decision class d, τsys(d) is the interval between the system's commitment to an action and the realisation of its consequence, and τH (d) is the human's end-to-end response latency — detection, orientation, decision and act — conditional on availability. The configuration is on-the-loop only where τH < τsys, and out-of-the-loop where τH ≥ τ sys. Nothing in that definition refers to a policy document, an org chart or a role description. It refers to two measurable durations. Sections 3.2 and 3.3 assemble what is known about τH , including the component oversight designs routinely omit; Section 3.4 supplies τsys; Section 3.5 states the two propositions. One caution on sources. The driving literature is not offered as a model of corporate decision-making; task, stakes and sensory channel all differ. It is offered because it is the only literature in which human intervention latency under automation has been measured at scale, and its findings are used here for structural properties of the human response — magnitude relative to machine cycle times, variance, response to slack, and the separability of latency from quality — not as a transferable numeric constant. 3.2 How long human intervention actually takes The best available aggregate is Zhang, de Winter, Varotto, Happee and Martens (2019), a peerreviewed meta-analysis in Transportation Research Part F covering 129 studies and yielding 520 mean or median take-over time observations. The average mean take-over time was 2.72 s (SD = 1.45, n = 520), and mean take-over time across studies and conditions ranged from 0.69 s to 19.79 s: a central tendency of a few seconds, with a between-condition spread covering a factor of nearly Human-on-the-Loop · WP No. 8 3. Position Is Determined, Not Chosen 13 thirty. Three further findings matter more than that mean, and each is counter-intuitive in a way that damages a common oversight design. The first is the time-budget effect. A strong effect of time budget was found, with a higher mean take-over time — an average difference of 1.35 s — for a large time budget compared with a small one. More headroom did not produce a faster intervention; it produced a slower one. Humans consume the budget they are given. This is meta-analytic evidence against any oversight servicelevel agreement premised on engineered slack being converted by the human into a margin of safety. It is converted into elapsed time. The second is the mean–standard-deviation relationship. The correlation between the mean and the standard deviation of take-over times was strong, r = 0.82 (Spearman's rank correlation 0.73, n = 397). Two qualifications belong in the same breath as the figure, since the paper elsewhere insists on them. This is a between-study relationship among study-level means and standard deviations, so inferring the variance structure of any single deployment from it is an ecological inference; and a positive mean–standard-deviation relationship is close to mechanical in bounded, right-skewed distributions, of which response times are the standard case. The conclusion does not need the correlation to carry it. Mean take-over times ranged across conditions from 0.69 s to 19.79 s, and the authors state, as the next paragraph records, that collision risk is set by the tail rather than by the mean. One cannot design an on-the-loop configuration to a central tendency. The third is the authors' own limitation, which should be reported in substance rather than paraphrased away. Zhang et al. state that collision risk is not determined by the mean take-over time, but by outliers in the take-over time distribution: the meta-analysis measures the wrong moment of the distribution for safety purposes, and says so. They further note that take-over quality was not examined at all. And nearly all included studies are driving-simulator studies, so the behavioural validity of the corpus is an open question the authors flag rather than resolve. A reader who accepts that the risk is set by the tail will want to know where the tail is, and the honest answer is that this literature does not say. Zhang and colleagues report means, standard deviations and a range; they report no percentiles, and none is quoted here. What the reported moments do license is arithmetic, and it is offered as arithmetic and not as a finding. Treating the reported average mean of 2.72 s and standard deviation of 1.45 s as the parameters of a normal distribution places the ninety-fifth percentile at 2.72 + 1.645 × 1.45 ≈ 5.1 s and the ninety-ninth at approximately 6.1 s. That calculation assumes symmetry, which the same paper's own numbers contradict: a maximum of 19.79 s against a mean of 2.72 s, together with the strong positive relationship between means and standard deviations recorded above, indicates a right-skewed distribution, for which a normal approximation understates the upper tail. Fitting instead a lognormal distribution to the identical mean and standard deviation — the standard shape for bounded, right-skewed response times — moves the ninety-fifth percentile to approximately 5.5 s and the ninety-ninth to approximately 7.7 s. The normal figures are therefore floors under their own assumption, and the gap between the two shapes widens the further out one goes. Two limits must be stated with the exercise. Both sets of figures are consequences of an assumed distributional shape rather than observations, so neither is a percentile of anything. And neither is a percentile of individual take-over times in any event: the reported standard deviation is the dispersion of studylevel and condition-level means, so the arithmetic describes the spread of averages and not the tail of the human responses a design must actually survive, which will be wider still. The designrelevant quantity is thus a percentile the literature does not report, and a firm that sets an oversight response time from a published mean is specifying against the wrong statistic. That is precisely why Appendix A instructs a firm to report its own interaction time at the median and the ninetieth percentile rather than at the mean. Human-on-the-Loop · WP No. 8 3. Position Is Determined, Not Chosen 14 The simulator caveat makes the real-road datapoint disproportionately valuable. Gershon, Mehler and Reimer (2023), peer-reviewed in Traffic Injury Prevention, instrumented 14 drivers over 5,514 miles of hands-free Super Cruise and captured 265 system-initiated disengagements. Take-over time was 2.4 s hands-free and 1.8 s with a hand already on the wheel — consistent with the meta-analysis and, on their own, reassuring. The decisive number is different: the time to begin recovering normal on-road glance behaviour was 6.1 s, and glance transitions increased by 43 per cent. This licenses the distinction on which the rest of the paper depends. Grabbing control is not being in control. "Intervention initiated" and "supervisory competence restored" are different events, separated in the only deployed measurement available by a factor of roughly 2.5. Any τH defined as the moment the human's hand reaches the control surface prices the attentional handover at zero — and it is the attentional handover that determines whether the intervention is any good. Whether the intervention is any good turns out to be almost unrelated to how quickly it began. Louw, Markkula, Boer, Madigan, Carsten and Merat (2017), peer-reviewed in Accident Analysis & Prevention with N = 75 in a between-participants simulator design, manipulated visual information about the road and the automation state to induce out-of-the-loop states. Reducing visual information slowed take-over times but did not affect collision-avoidance timing, and long take-over duration did not predict collisions. The authors' summary is that take-over time and the timing and quality of the avoidance response appear to be largely independent. A latency service-level agreement can therefore be fully satisfied while intervention quality is unchanged: a firm reporting median response times as evidence of effective oversight is reporting a quantity the evidence says is orthogonal to what it is offered as evidence of. The fastest human intervention figure in the verified record comes from Dixit, Chand and Nair (2016), peer-reviewed in PLOS ONE, using California DMV autonomous-vehicle disengagement reports covering 460,097 autonomous miles: a pooled mean reaction time of 0.83 s. All three caveats belong in the same breath as the figure. The measurement excludes perception time, so 0.83 s is a motor response and not a detect–decide–act latency; only two companies reported exact measurements, the others giving upper bounds only; and these were trained, paid, professional safety drivers whose sole job was to watch, with no competing task — the most favourable possible case. The figure is a floor, not a representative value, and it should never be a design target for an overseer who has other work. The same paper supplies a finding more interesting than its headline. Reaction time increased with cumulative autonomous miles: Mercedes-Benz r = 0.122, p = 0.007; Google r = 0.161, p = 0.029. The authors interpret this as trust degrading response speed with exposure. Even in the population selected and paid to be maximally vigilant, τH was not a constant of the human but a function of operating history, and it moved in the direction that erodes the on-the-loop condition. A firm that measures τH once at deployment is measuring the most favourable moment in the system's life. 3.3 The knowledge-work overhead nobody counts: interruption and resumption In corporate deployments the overseer is not a safety driver whose only job is to watch, but a person doing other work who is pulled out of it by an exception. τH therefore contains a component the driving literature does not isolate: the cost of leaving one task and returning to it. The controlled measurements come from Monk, Trafton and Boehm-Davis (2008), peer-reviewed in the Journal of Experimental Psychology: Applied. Resumption lag was 949 ms (SD 283) in the uninterrupted baseline, rising to 1,157 ms, 1,398 ms and 1,639 ms after interruptions of 3 s, 8 s and 13 s respectively. Their second experiment established the functional form: resumption lag is logarithmic in interruption duration, fitted as y = 1032 + 189.4·log(x), R² = .989, asymptoting between 13 and 23 s. The cost lives in the switch, not the duration. A one-minute exception costs barely more Human-on-the-Loop · WP No. 8 3. Position Is Determined, Not Chosen 15 in resumption than a twenty-second one, so the arrival rate of exceptions, not their length, consumes the overseer. Their third experiment established what modulates the cost. Resumption lag was 1,322 ms when the interruption involved no task, 1,605 ms with a tracking task, and 1,789 ms with a high-demand nback task, the last producing roughly three times the error rate of the others (.06 versus .02 and .01). A supervisor pulled from one demanding exception into another pays a compounding cost, in errors as well as in seconds. The mechanism — a suspended goal must be re-retrieved from declarative memory through environmental cues after its activation has decayed — comes from Altmann and Trafton's (2002) memory-for-goals model, which contains no latency values of its own. The field magnitudes are larger by three orders of magnitude. Mark, Gonzalez and Harris (2005), a peer-reviewed CHI full paper, observed 24 knowledge workers in detail — seven managers, nine analysts, eight developers. The average length of time informants spent in central and peripheral working spheres was 11 min 4 s; 57.1 per cent of all working-sphere segments were interrupted; and when people did resume work on the same day, it took an average of 25 min 26 s. Two points of citation hygiene are required, and both are substantive. The figure of "23 minutes 15 seconds", almost universally attributed to this paper in management writing, does not appear in it; the paper's figure is 25 min 26 s. And that figure is conditional on same-day resumption — segments never resumed that day are excluded — which biases it downward relative to true resumption delay. The second hygiene case is more consequential. Mark, Gudith and Klocke (2008), also a peerreviewed CHI full paper with N = 48, is routinely cited as evidence that interruptions slow people down. It shows the opposite on time. Interrupted work was completed faster: 20.31 and 20.60 minutes in the same- and different-context conditions against a 22.77-minute uninterrupted baseline, F(2, 77.98) = 3.36, p < .05. The cost appeared elsewhere. Stress rose from 6.92 to 9.46 on a 1– 20 scale (F(2,92) = 12.15, p < .001); workload, frustration, time pressure and effort all rose significantly; and interrupted participants wrote shorter emails (31.49 words down to 29.17 and 30.16, p < .04). Used for the finding it actually supports, this is one of the most important results in the paper. The supervisor absorbs the cost of exception handling as strain and as compressed output, not as visible delay. The work still gets done, on time or sooner, which is precisely why an insolvent oversight regime does not announce itself: there is no queue to observe, no missed deadline to escalate, no throughput signal that degrades. The indicators a management system watches remain green while the quality of the human's contribution is silently traded away. Section 4.4 shows what that trade looks like once it has run to completion in a deployed exception channel. Table 2 collects the measured latencies on which Sections 3.2 and 3.3 rest, each figure placed beside the limitation its own authors state. Study Setting and N Measured latency Caveat stated by the authors Zhang et al. (2019) metaanalysis 129 studies, 520 observations, simulators Mean take-over 2.72 s (SD 1.45); range 0.69–19.79 s; +1.35 s for a larger time budget Collision risk is set by the tail, not the mean; quality not examined. Gershon, Mehler & Reimer (2023) Real roads, hands-free L2, 14 drivers, 265 disengagements Take-over 2.4 s hands-free, 1.8 s with a hand on the wheel; 6.1 s to begin recovering on-road glance behaviour Single vehicle platform; small driver sample. Louw et al. (2017) Simulator, N = 75 Take-over time and avoidance quality "largely independent" Simulator; induced out-ofthe-loop states. Human-on-the-Loop · WP No. 8 3. Position Is Determined, Not Chosen 16 Study Setting and N Measured latency Caveat stated by the authors Dixit, Chand & Nair (2016) 460,097 autonomous miles, California disengagement reports Pooled mean reaction 0.83 s; reaction time rose with cumulative miles Excludes perception time; professional safety drivers; only two firms reported exact values. Monk, Trafton & Boehm-Davis (2008) Laboratory, N = 12 and 36 Resumption lag 949 ms uninterrupted, rising to 1,639 ms after a 13 s interruption; 1,789 ms after a high-demand interruption Environmental cues may have aided resumption; no conclusions beyond one minute. Mark, Gonzalez & Harris (2005) Field ethnography, 24 knowledge workers Working-sphere segments 11 min 4 s; same-day resumption 25 min 26 s; 57.1% of segments interrupted Conditional on same-day resumption, so downward biased. Table 2. Measured human intervention latency. 3.4 What the system side of the ratio looks like Against these human latencies, consider two documented automated decision classes at opposite ends of the evidence-grade scale. The first is a primary regulatory record. The U.S. Securities and Exchange Commission's Administrative Proceeding, Release No. 34-70694, documents that on 1 August 2012 Knight Capital's system produced four million executions in 154 stocks for more than 397 million shares in approximately 45 minutes, and a loss of approximately $460 million. Four million executions over roughly 2,700 seconds is a derived rate of approximately 1,481 executions per second — an interexecution interval on the order of 0.7 ms. Against a human response latency measured in seconds, the ratio is roughly four orders of magnitude, and no governance policy or designated accountable officer alters that arithmetic. Section 9 returns to the case, where the point of interest is not that oversight was absent but that human operators were working the incident throughout and their first corrective action worsened it. The second is a preprint and should be labelled as such. OSWorld 2.0 (arXiv:2606.29537) reports approximately 318 tool calls per task against a median human completion time of about 1.6 hours, where the 2024 predecessor benchmark required roughly 30. The two figures are not a series and are not used as one here. OSWorld 2.0 selects long-horizon tasks by design, and its own maintainers state that scores across the earlier and later versions are not comparable, so the difference in tool calls is a property of the tasks selected rather than of agent behaviour over time; the later tasks are also much longer, so the two counts are not comparable per unit of work either. What the figure establishes is the action-to-attention ratio for one documented class of task, and that is all the argument requires. The dilemma it creates should be stated plainly, because it is the binding design constraint and it is not a capability question. If the human must review each action to retain accountability for the outcome, then at 318 actions per task the oversight costs more than the work, and the configuration is in-the-loop only in being slower and dearer than doing the task unaided. If the human reviews only the final output, they are accepting approximately 318 unreviewed state changes — file writes, form submissions, API calls, deletions — each of which may have committed a consequence the final output does not display. There is no third option: sampling is the second branch with a stated coverage fraction, and automated pre-filtering relocates the review to another automated system, which Sections 6 and 7 address. Model capability is not the binding constraint on oversight design. The action-to-attention ratio is. Human-on-the-Loop · WP No. 8 3. Position Is Determined, Not Chosen 17 Figure 2. The determination of loop position. Measured human latencies against system consequence latencies on a logarithmic time axis. Human side: take-over time 2.72 s mean, 0.69–19.79 s across conditions (Zhang et al. 2019); attentional recovery onset 6.1 s (Gershon et al. 2023); resumption lag 0.95–1.9 s (Monk et al. 2008); field resumption 25 min 26 s, conditional on same-day resumption (Mark et al. 2005). System side: approximately 0.7 ms between executions at the Knight Capital rate (SEC Rel. 34-70694), an agent tool call, an automated credit decision, a quarterly capital allocation. Shading marks τsys < τH , where an on-the-loop configuration is unavailable irrespective of policy. 3.5 Two propositions, and why formal authority survives the collapse of real authority Proposition 1 (Position determination). Holding the human's response latency fixed, any increase in the throughput or consequencespeed of an automated decision class monotonically shifts the achievable oversight position from in-the-loop toward out-of-the-loop, regardless of the governance policy asserted. Refutation condition. Refuted if a deployment is documented in which mean consequence latency fell below the measured human end-to-end response latency for a decision class and contemporaneous human approval nonetheless remained determinative of outcomes — i.e. approvals materially altered the action distribution rather than ratifying it. Proposition 1 is a statement about feasibility. It does not explain why a firm operating past that boundary continues to report that a human is in control, nor why the humans concerned continue, in good faith, to sign. The explanation lies in the economics of authority, and it is not a story about weakness of will. Aghion and Tirole (1997), Journal of Political Economy 105(1):1–29 — peerreviewed and theoretical, with no data — distinguish formal authority, the right to decide, from real authority, effective control over decisions, and make real authority a function of the structure of information. Where the principal is uninformed and the agent informed, their phrasing is that a poorly informed principal optimally rubber-stamps the subordinate's proposal by fear of picking a worse alternative. The word carrying the argument is optimally. Rubber-stamping is not a failure of diligence to be corrected by exhortation; it is the informed response of a decision-maker who knows The determination of loop position on-the-loop unavailable: τsys < τH 1 ms 10 ms 100 ms 1 s 10 s 1 min 10 min 1 h human response latency τH take-over time, mean 2.72 s (range 0.69–19.79 s) real-road take-over 2.4 s attentional recovery 6.1 s resumption lag 0.95–1.9 s field task resumption 25 min 26 s system consequence latency τsys Knight Capital: ~0.7 ms between executions one agent tool call automated credit decision quarterly capital allocation Human-on-the-Loop · WP No. 8 3. Position Is Determined, Not Chosen 18 that overruling a better-informed party raises the probability of a worse outcome. Formal authority survives intact. It is simply nominal. The determinants of the subordinate's real authority that Aghion and Tirole enumerate for a formally integrated structure are overload, lenient rules, urgency of decision, reputation, performance measurement, and multiplicity of superiors. Two of those — overload and urgency of decision — are not accidents that befall an on-the-loop configuration; they are what it constructs by design. Routing exceptions from a high-throughput system to a human who has other work is the definition of overload; requiring the decision inside τsys is the definition of urgency. The configuration manufactures, as a matter of architecture, the two conditions the model identifies as transferring real authority away from its formal holder. Proposition 2 (Rubber-stamping). Where the human's information about a decision is strictly poorer than the system's and the decision must be taken within τsys, the human's formal authority is exercised as ratification. Real authority has transferred to the system. Refutation condition. Refuted if, under those informational and temporal conditions, override rates and override accuracy are shown to be independent of the human's information disadvantage. There is a stronger version of this argument that the paper must confront honestly rather than deploy selectively. Dessein (2002), Review of Economic Studies 69(4):811–838, peer-reviewed and theoretical, shows that a principal prefers to delegate control to a better-informed agent rather than communicate with that agent, as long as the incentive conflict is not too large relative to the principal's uncertainty about the environment — and, decisively here, that keeping a veto right typically reduces the principal's expected utility unless the incentive conflict is extreme. The mechanism is that communication is lossy: under cheap talk the agent's information is coarsened in transmission, so the principal trades noise-in-communication against bias-in-objective, and delegation wins over a wide parameter range. This cuts against the paper's own subject matter and should be allowed to. Dessein is a strong argument that veto-based oversight — precisely the technical content of the on-the-loop configuration, as Section 2 established — is usually value-destroying relative to clean delegation plus objective alignment. A firm installing a human veto over a better-informed system, where objectives are broadly congruent, is on this analysis making itself worse off and calling it governance. But the honest reading runs in both directions. Dessein's veto result is explicitly conditioned on the incentive conflict not being extreme, and he leaves the extreme case open. Safety-critical deployment, and more generally deployment where the system's objective is a proxy that diverges from the principal's in the tail, is a candidate for exactly that carve-out. The result is a genuine constraint on when veto-based oversight is worth its cost, and it implies that configurations installed for reassurance rather than for tail risk are net-negative. What it does not license is the inference that veto authority is always value-destroying. It relocates the question to whether the misalignment is extreme — an empirical question about a given deployment, which Sections 6 and 7 take up in terms of information channels and verifier independence rather than incentive conflict. The section closes on the observation that motivates Section 4. A firm that keeps "a human in the loop" while raising throughput does not retain in-the-loop control. It silently converts in to on, and then on to out, because the ratio defining the position moves while the policy naming it does not. The conversion is invisible from the dashboard because approval rates do not fall; they rise, or hold at a level read as evidence that the system performs well. The overseer is still there, still signing, still Human-on-the-Loop · WP No. 8 3. Position Is Determined, Not Chosen 19 accountable — and, by Aghion and Tirole's own logic, still behaving optimally. What has been lost is not presence, diligence or formal rights, but the precondition under which any of the three would have had control content. 4. Oversight as a Consumable Resource 4.1 Oversight is not a role Section 3 established that loop position is determined by a ratio the firm does not control. This section makes the second of the paper's three theoretical moves: oversight is not a role that can be assigned, but a consumable resource with a measurable capacity, and that capacity can be exhausted. A firm that assigns oversight the way it assigns a job title has named a duty without provisioning the input the duty consumes. The input is attention, and the canonical statement of its scarcity is Simon (1971). The source is a chapter in an edited conference volume — Computers, Communications, and the Public Interest, edited by Martin Greenberger, Johns Hopkins Press, pp. 37–72 — and it is not a peer-reviewed article; it should be cited as what it is, an argument of exceptional influence rather than a tested finding. The passage, at p. 40, reads: "In an information-rich world, the wealth of information means a dearth of something else: a scarcity of whatever it is that information consumes. What information consumes is rather obvious: it consumes the attention of its recipients. Hence a wealth of information creates a poverty of attention and a need to allocate that attention efficiently among the overabundance of information sources that might consume it." Ocasio (1997), Strategic Management Journal 18(S1):187–206, peer-reviewed and theoretical, converts Simon's individual-level scarcity into a firm-level design variable. His central argument is that firm behaviour is the result of how firms channel and distribute the attention of their decisionmakers, structured through three linked principles: focus of attention, situated attention, and the structural distribution of attention through the firm's rules, resources and relationships. On this account the firm does not merely use attention. The firm is an attention-allocation structure. That reading licenses the move this section makes. If the firm is an attention-allocation structure, then introducing an automated system that emits candidate actions faster than attention can be allocated to them is not a productivity change. It is a change in the firm's constitution. It alters which situations decision-makers find themselves in, which issues reach them, and in what volume — the three variables Ocasio identifies as constitutive of firm behaviour. A deployment decision taken as an efficiency matter, at the level of a functional budget, is in fact a decision about where the firm's authority resides. The remainder of this section makes the capacity constraint explicit enough that the decision can be taken with its consequences visible. 4.2 The solvency constraint Definition 3 (Oversight capacity). The overseer's uncommitted attention A over an interval is the quantity of time in that interval not already claimed by other assigned work. Interaction time IT is the mean time to handle one exception to closure. Context re-acquisition cost c is the additional time to restore the working state of the task the overseer was displaced from. Neglect time NT is the interval a supervised process can proceed unattended before its expected performance falls below threshold. Human-on-the-Loop · WP No. 8 4. Oversight as a Consumable Resource 20 Definition 4 (Oversight solvency). An on-the-loop configuration with exception arrival rate λ is solvent iff λ·(IT + c) ≤ A and the supervised process count N satisfies N ≤ NT/(IT + WT) + 1, where WT is the queueing delay when several processes demand attention simultaneously. A configuration failing either condition is insolvent. Insolvency is not observed as refusal; it is observed as acceptance — override, dismissal and non-response rise until the constraint is satisfied by shortening IT to zero. One property of that statement should be flagged before the formula is read, because the notation invites the opposite reading. Definitions 3 and 4 write A, IT, c and NT as constants over the period, which is a simplification adopted for tractability rather than a claim about the overseer: each of the four drifts within a single period of duty, and in the direction that tightens the constraint. Section 4.7 assembles the measured instances and draws the consequences. ρ = λ·(IT + c)/A ≤ 1   and   N ≤ NT/(IT + WT) + 1 The first condition is written here as a utilisation ratio, which is the form in which it should be reported. Both sides of Definition 4's inequality are durations per period: λ is a count of exceptions per period and IT and c are times per exception, so their product is the time the exception stream demands in that period, while A is the time available in the same period. Their quotient ρ is therefore dimensionless, and solvency is the statement that it does not exceed unity. Reporting ρ rather than the two sides separately has a practical merit: it is the single number that says how far a configuration is from the boundary, and a firm that reports a value above one has reported that its oversight is insolvent without needing any further interpretation. The period must be stated and must be the same on both sides — a working day is the natural choice where exceptions arrive continuously — and the span bound is dimensionless in the same way, NT, IT and WT all being times per event. Each term is operational, and a firm that wished to could measure all six. The arrival rate λ is the count of exceptions routed to a named overseer per unit time, taken from the routing system rather than the design document; it is the one term firms almost always have and never publish. Interaction time IT is the elapsed time from an exception surfacing to its disposition being recorded, measured to closure and not to first touch — the distinction Section 3.2 drew between motor handover and restored competence applies here, and an IT measured to acknowledgement is measuring the wrong event. Context re-acquisition cost c is the additional time required to restore the displaced task, which Section 3.3 showed to be between roughly 0.95 and 1.9 s per switch in controlled conditions and, in observed knowledge work, on a wholly different scale. Uncommitted attention A is the term firms systematically overstate, because it is not headcount and it is not nominal availability. It is the time in the period not already claimed by other assigned work, and the measurement is subtractive: contracted time less every other duty carrying a delivery expectation. For an overseer who retains a full operational role that subtraction will frequently return a value at or near zero. That is not a defect in the test but its result. It says that no time has been provisioned for oversight, so ρ exceeds unity at any positive arrival rate and the configuration is insolvent by construction — which is a finding about the configuration, not a deficiency of the definition. The corresponding instruction is that A must be provisioned rather than measured: work is removed from the role until the time released covers λ·(IT + c), and the disclosure that evidences the provisioning is the list of duties removed when the oversight duty was added. This is Proposition 4 restated as an instruction. A is a quantity a firm allocates; it is not a residual a firm discovers. Human-on-the-Loop · WP No. 8 4. Oversight as a Consumable Resource 21 Neglect time NT is the only term that is a property of the supervised system rather than of the human: the interval a process can run unattended before its expected performance falls below threshold. Its analogue in an agentic deployment is the number of consequential actions taken before an error becomes costly to reverse, which is why Section 3.4's action counts bear on it. And WT, queueing delay, makes the second inequality bite: it is zero in the single-process case and grows with N, so span degrades faster than the naive ratio NT/IT suggests. The two conditions are less independent than their presentation as a pair suggests, and what relates them is an assumption about where the exception stream comes from. The span bound is derived on the supposition that each supervised process demands attention once per neglect interval, that is λ = N/NT. That is a substantive restriction on the deployment rather than a modelling convenience, and three regimes must be distinguished, because the model's applicability and the remedy for insolvency both differ across them. endogenous:  λ = N/NT   ·   exogenous:  λ = N/NT + λext ⇒  N ≤ (A/(IT + c) − λext)·NT In the first regime the stream is endogenous: every exception originates in a supervised process and none arrives from anywhere else. Then λ = N/NT holds exactly, and substituting it into the solvency condition λ·(IT + c) ≤ A returns N ≤ NT·A/(IT + c), which is the span bound up to the additive constant and the substitution of the queueing correction WT for the re-acquisition cost c. The two inequalities are one constraint written twice, and a firm in this regime that satisfies either satisfies both. The remedy for insolvency is correspondingly single-valued: reduce N or raise NT — supervise fewer processes, or make each of them safer to leave alone. In the second regime part of the stream is exogenous, arriving independently of the supervised processes: a customer escalation, a regulator's query, an incident reported by someone outside the system. The arrival rate is then λ = N/NT + λext, and substituting that into λ·(IT + c) ≤ A tightens the span bound to N ≤ (A/(IT + c) − λext)·NT. The two inequalities have now diverged, because solvency binds on the total while the span bound was derived from the endogenous part alone. The consequence is a usable result and should be stated plainly. Exogenous arrivals consume supervisory span directly, at an exchange rate of NT processes for each unit of exogenous arrival rate: a channel receiving one further escalation per neglect interval has lost the capacity to supervise one process, whatever the supervised processes happen to be doing. A firm therefore cannot infer its supervisable span from the behaviour of the supervised processes alone, and an oversight configuration sized against internal telemetry — which records what the system emits and not what arrives about it — will be systematically oversized. The third regime is mixed and non-stationary, and it is the realistic one. λext is typically bursty rather than smooth, and it is correlated with the failures the supervision exists to catch: a fault in the supervised processes generates escalations, enquiries and regulatory attention about that fault, so the exogenous term peaks at exactly the moment the endogenous term does. The model as written treats λ as a rate and therefore averages over that structure, which understates the constraint under bursty arrival — a configuration solvent in the mean can be insolvent throughout the interval in which the exceptions actually arrive. This is a limitation of the model rather than a result of it. The queueing delay WT is its sole representation of contention, it is not derived here from any arrival process, and no distributional assumption is offered from which it could be. The two conditions should therefore be read as necessary and not as sufficient, and a firm should state which of the three regimes it takes itself to be in. Human-on-the-Loop · WP No. 8 4. Oversight as a Consumable Resource 22 4.3 The measured span Span has been measured properly in one setting: supervisory control of multiple semi-autonomous robots. Crandall and Cummings (2007), peer-reviewed in IEEE Transactions on Robotics 23(5), with N = 12 participants supervising teams of two, four, six and eight robots, found interaction time of approximately 15–17 s and — the notable part — remarkably stable across team sizes, with only 2.34 s difference between the two-robot and eight-robot conditions. Neglect time rose steeply, from approximately 30 s at two robots to over 120 s at eight. This is the citable source for both fan-out formulations: FO = NT/IT + 1, and, with queueing, FO = NT/(IT + WT) + 1. Measured capacity fell between four and six robots. Effectiveness plateaued at six and degraded at eight, where operators lost more robots. The failure signature is the finding the present paper most needs: six-robot teams collected significantly more hard-to-reach objects than smaller teams but lost more robots. The capacity boundary announced itself as a quality and loss failure, not as a throughput failure. Throughput was still rising when quality had already turned. The replication and extension is Crandall, Cummings, Della Penna and de Jong (2011), peerreviewed in IEEE Transactions on Systems, Man, and Cybernetics — Part A 41(3):385–397, with N = 16 in the first study and N = 12 in the second. Average tokens collected peaked at about six robots; eight-robot teams performed significantly worse, driven by a twelvefold increase in robot losses between two and eight. The authors trace the mechanism explicitly to attention allocation — the decrease in system effectiveness in large teams is attributed to the way operators allocated their attention among the robots — rather than to any deficit of speed. The concrete signature was that roughly 40 per cent of robots in the eight-robot condition were sent out without collecting tokens in the final minute, against roughly 10 per cent in the four- and six-robot conditions. Their second study should discipline every claim that better tooling raises the span. Three interface modes were compared for supporting attention allocation. The automated mode achieved over 95 per cent adherence to optimal recommendations and significantly reduced perceived workload, and produced no statistically significant performance improvement whatever: F(2,33) = 0.50, p = 0.609. Sixty-seven per cent of users disliked it. Automating the attention-allocation layer improved compliance and comfort and did not improve outcomes. A tooling investment that moves the compliance metric and the workload metric without moving the performance metric has bought the appearance of capacity. The conceptual account of why the ceiling sits where it does comes from Olsen and Goodrich (2003), which introduced the fan-out construct. This is a PERMIS workshop paper and is not peer-reviewed; it contains no measured values and should be treated as a conceptual source. Its useful line is that context re-acquisition is probably the largest contributor to an upper bound on fan-out. The ceiling on supervision is set by the cost of rebuilding situational context, not by the mechanical cost of acting — which is precisely why the term c appears in Definition 3 and why IT measured to first touch understates the true cost. One negative result must be stated plainly. Cummings and Mitchell (2008), IEEE Transactions on Systems, Man, and Cybernetics — Part A 38(2):451–460, is frequently cited for a specific operatorutilisation ceiling above which supervisory performance degrades. The verification pass conducted for this paper could not obtain any quantitative result from it: the bibliographic record was confirmed at Crossref, but no figure from the paper could be independently checked. This paper therefore cites the record and quotes no number from it, and readers encountering a utilisation threshold attributed to that source elsewhere should treat it as unverified here. Human-on-the-Loop · WP No. 8 4. Oversight as a Consumable Resource 23 Study N Interaction time (IT) Neglect time (NT) Effective span Failure signature Crandall & Cummings (2007), IEEE T-Robotics 23(5); peer-reviewed 12 ≈15–17 s; stable across team size (2.34 s difference, 2 vs 8 robots) ≈30 s at 2 robots to >120 s at 8 4–6; plateau at 6 At 6: more hard-to-reach objects collected and more robots lost. Quality/loss failure before throughput failure. Crandall, Cummings, Della Penna & de Jong (2011), IEEE TSMC-A 41(3):385–397, Study 1; peerreviewed 16 — — Peak system score ≈6 robots 12× increase in robots lost from 2 to 8; ≈40% of robots idle-dispatched at 8 vs ≈10% at 4–6. Crandall et al. (2011), Study 2; peerreviewed 12 — — — Automated attention allocation: >95% adherence, lower workload, no significant performance gain (F(2,33) = 0.50, p = 0.609); 67% of users disliked it. Olsen & Goodrich (2003), PERMIS workshop; not peerreviewed — No measured values No measured values Framework only (FO = NT/IT + 1) Ceiling attributed to context re-acquisition rather than to the cost of acting. Cummings & Mitchell (2008), IEEE T-SMC-A 38(2):451–460; peerreviewed — Record verified; no quantitative result obtainable in verification. No figure quoted in this paper. Table 3. Measured supervisory span in the settings where it has been measured. 4.4 What insolvency looks like in the field The robotics studies measure the boundary under laboratory conditions. What an exception channel looks like after years of operation past that boundary is documented at very large scale in clinical decision support. van der Sijs, Aarts, Vulto and Berg (2006), a peer-reviewed systematic review in JAMIA 13(2):138–147 covering 17 papers, found override rates for drug safety alerts ranging from 49 to 96 per cent. Poly, Islam, Yang and Li (2020), a peer-reviewed systematic review in JMIR Medical Informatics 8(7):e15653 covering 23 articles, found override rates of 46.2 to 96.2 per cent. The comparison should be made explicitly, because it is the strongest single argument in this paper against interfacelevel remedies: across fourteen years of alert redesign, tiering, severity grading and usability work, the override range moved essentially not at all. Whatever is generating these rates is not an interface defect. The cleanest single-system measurement is Nanji, Slight, Seger, Cho, Fiskio, Redden, Volk and Bates (2014), peer-reviewed in JAMIA 21(3):487–491: 2,004,069 medication orders generated 157,483 alerts, an alert rate of 7.9 per cent, of which 82,889 — 52.6 per cent — were overridden. The same study supplies the finding that prevents the argument from becoming a complaint about clinicians. A subsample of 600 overrides was clinically reviewed, and 53 per cent were judged appropriate, with a range from 12 per cent for renal recommendations to 92 per cent for patient allergies. A high override rate is therefore not by itself evidence of human failure. Roughly half the time the human was right and the automation was wrong, which is evidence of a miscalibrated channel rather than Human-on-the-Loop · WP No. 8 4. Oversight as a Consumable Resource 24 of an unreliable overseer. But the renal figure carries the opposite implication with equal force: in that specific low-salience, high-stakes category, the human was wrong about 88 per cent of the times they overrode. Both directions belong in the same paragraph, and an oversight regime designed on either one alone will be designed wrongly. The dose–response evidence comes from Ancker, Edwards, Nosal, Hauser, Mauer and Kaushal (2017), peer-reviewed in BMC Medical Informatics and Decision Making 17:36 — a retrospective cohort of 112 ambulatory primary care clinicians, 1,266,325 best-practice advisories and 326,203 drug interaction alerts. Note that a published Correction exists (PMID 31739801) and should be consulted before any figure is reused. Drug-alert acceptance overall was less than 1 per cent: the channel is, functionally, dead. Acceptance fell by 30 per cent for each additional reminder received per encounter (IRR = 0.70, p < .001). The path dependence is striking: where the first instance of an alert was overridden, 87.9 per cent of subsequent instances were overridden for advisories and 99.9 per cent for drug alerts, against 51.9 and 58.4 per cent respectively where the first instance had been accepted. And the finding that identifies the mechanism is a null: general workload showed no significant association with acceptance. It is alert volume per encounter, not busyness, that drives desensitisation. That distinction matters for design, because it means the remedy is not a lighter workload but a lower arrival rate — λ, not A. The precision side of the same equilibrium is measured by Drew, Harris, Zègre-Hemsey and colleagues (2014), peer-reviewed in PLOS ONE 9(10):e110274: 461 consecutive ICU patients over 31 days generated 2,558,760 unique alarms, of which 381,560 were audible — equal to 187 audible alarms per bed per day, roughly one every eight minutes around the clock. Of 12,671 annotated arrhythmia alarms, 88.8 per cent were false positives. The study could not report false negatives, a limitation the authors state. What these two studies jointly support should be stated carefully, because they are not one system and their figures do not compose. Drew et al. measure the arrival rate and the precision of a single saturated channel: 187 audible alarms per bed per day from continuous physiologic monitors, with 88.8 per cent of annotated arrhythmia alarms false. Ancker et al. measure, in a different channel with a different population, signal type, response modality and time base — ambulatory advisories and drug alerts routed to a clinician at an encounter, not a bedside monitor running around the clock — the dose–response by which acceptance falls as volume per encounter rises. Per bed-day and per encounter are not the same denominator, and nothing here is a natural experiment: there is no exogenous variation in the arrival rate, no counterfactual arm and no assignment mechanism, and neither study could measure its false-negative rate, which is precisely the quantity an insolvency claim would want. Taken together, what they are consistent with is the mechanism rather than a magnitude: a channel whose arrival-rate-weighted cost exceeds the attention available to it is satisfied in the only way available to it, by driving interaction time toward zero, which is what Definition 4 says insolvency looks like. Read that way, desensitisation is not an indiscipline to be corrected by training, reminders about professional responsibility or a stronger accountability framework. It is the behaviour the configuration selects for. Study Design and scale Override / acceptance Appropriateness van der Sijs et al. (2006), JAMIA 13(2):138–147; peer-reviewed systematic review 17 papers Override 49–96% Not pooled; authors note studies of the cognitive processes behind overriding are lacking Nanji et al. (2014), JAMIA 21(3):487–491; peerreviewed 2,004,069 orders → 157,483 alerts (7.9%) 82,889 overridden (52.6%) 600 reviewed: 53% appropriate; 12% (renal) to 92% (allergy) Human-on-the-Loop · WP No. 8 4. Oversight as a Consumable Resource 25 Study Design and scale Override / acceptance Appropriateness Ancker et al. (2017), BMC MIDM 17:36; peerreviewed (see Correction, PMID 31739801) 112 clinicians; 1,266,325 advisories + 326,203 drug alerts Drug-alert acceptance <1%; acceptance −30% per additional reminder per encounter (IRR 0.70, p < .001) Not assessed; path dependence 87.9% (advisories) / 99.9% (drug) after a first override; workload not significant Poly et al. (2020), JMIR Med Inform 8(7):e15653; peer-reviewed systematic review 23 articles Override 46.2–96.2% 29.4–100% overall; drug–drug interaction 0–95% Drew et al. (2014), PLOS ONE 9(10):e110274; peerreviewed observational 461 ICU patients, 31 days; 2,558,760 alarms, 381,560 audible 187 audible alarms per bed per day 88.8% of 12,671 annotated arrhythmia alarms false positive; false negatives not measurable Table 4. Exception-channel saturation in deployed alerting systems, 2006–2020. 4.5 Vigilance is work, not idleness The solvency constraint assumes that watching costs something. That assumption is not obvious — the managerial intuition is that monitoring is a light duty which can be layered onto an existing role — and it is the assumption on which Proposition 4 turns. The evidence contradicts the intuition directly. Warm, Parasuraman and Matthews (2008), Human Factors 50(3):433–441, is a peer-reviewed narrative review rather than an experiment, and should be labelled as such; it reports no N of its own. Its conclusion is that converging evidence from behavioural, neural and subjective measures shows that vigilance requires hard mental work and is stressful. Vigilance tasks are resourcedemanding, not under-stimulating: NASA-TLX global workload scores for vigilance tasks fall at the upper end of the scale, transcranial Doppler measures show cerebral blood flow velocity declining in parallel with the performance decrement, and subjective measures show reduced task engagement with increased distress.